RuntimeBroker.exe the Mysterious Process

In this post we will take a closer look at the RuntimeBroker.exe process in Windows 10. As per Microsoft’s KB4027837 :

“Runtime Broker is a Windows process in Task Manager that helps manage permissions on your PC for apps from Microsoft Store.”

As per the article if the memory usage exceeds 15% Microsoft recommends to end the RuntimeBroker.exe process if your PC slows down and restart your PC. Unfortunately this isn’t a real solution in my opinion.

KB4027837 : Runtime Broker is using too much memory

“If your RAM use is high and your PC is running slowly, an app may be the cause of the problem. Press Ctrl+Shift+Esc to open Task Manager and then, on the Processes tab, check to see how much memory Runtime Broker is using. If its using more than 15% of your memory, you probably have an issue with an app on your PC. To stop Runtime Broker from using so much memory, select Runtime Broker in the list, select End task to close Runtime Broker, and then restart your computer.”

What is RuntimeBroker.exe Process really doing ?

I came accross RuntimeBroker.exe first, when I run Microsoft Store “Photos App” to view some of my photos and the CPU and Memory consumption increased rapidly on my Windows 10 PC. My notebooks fan continuosly run and had no intention to stop and was very loud. I was not rendering any photos, only viewing it therefore wondered why this action slowed down my PC and caused such a high resource consumption.

I opened task manager and saw that not the “Photos App” itself, instead the RuntimeBroker.exe consuming 50% of my CPU and 50 MB’s of memory. At that point I decided to take a closer look at RuntimeBroker.exe process to figure out what it is really doing. Based on Microsoft’s above article RuntimeBroker.exe process is only managing permissions but based on experience I know that not all things are mentioned inside Microsoft’s KB articles.

In-Depth Analysis

I immediately run Process Explorer v16.32 from Sysinternals which is now owned by Microsoft and figured out that RuntimeBroker.exe process not only managing permissions but also generating and caching thumbnails inside the “\thumbcache_*.db” files for the “Photos App“.

C:\Users\Cengiz Kuskaya\AppData\Local\Microsoft\Windows\Explorer\thumbcache_*.db

When the high CPU and Memory consumption occured inside “C:\Windows\System32\RuntimeBroker.exe” the status of the process was as follows.

- 30 Threads open to the CPU.
- 60 Handels open to the \thumbcache_*.db files.
- Created ton's of Mutants.

Basically the thumbnail caching mechanism was the reason for the high CPU and Memory consumption.

1. Open Handels to the “\thumbcache_*.db” files.

2. Open Threads to the CPU.

How to decrease the High CPU and Memory Usage in Runtime Broker ?

Microsoft’s solution to this problem is ending the process and restarting the PC. Unfortunately this won’t fix the problem because there isn’t a memory leak in Runtime Broker.

A leak is basically if you close the “Windows Store Photos App” and the CPU and Memory consumption doesn’t decrease. This is not the case in Runtime Broker process. Runtime Broker decreases immediately once you close the “Photos App”. Basically, like most of the Microsoft’s processes Runtime Broker doesn’t use the resources sparingly. It’s design isn’t well.

As a result we have only 2 options :

1. If Runtime Brokers High CPU and Memory Consumpiton disturbs you, you can either “Disable Thumbnails Cache in Windows Explorer”

or

2. Set the RuntimeBroker.exe Process Priority from Normal to Low. Ending the process task as Microsoft recommends doesn’t fix the problem because as long as you use Windows Store Photos App or you continue to use it Runtime Broker will immediately create a new Runtime Broker process.
 
Good luck !